CVE-2017-10271
Oracle Corporation WebLogic Server Remote Code Execution Vulnerability
Description
CVE-2017-10271 is a HIGH severity vulnerability in Oracle WebLogic Server that allows unauthenticated remote attackers to achieve code execution, carrying a CVSS 3.1 score of 7.5. Classified under CWE-306 (Missing Authentication for Critical Function), the flaw exists in the WLS Security component and is exploitable via the T3 protocol. Affected versions include Oracle WebLogic Server 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0, and 12.2.1.2.0. This vulnerability is notable for its confirmed ransomware association and has been extensively exploited for cryptocurrency mining campaigns. It was added to CISA's Known Exploited Vulnerabilities catalog on February 10, 2022, with a remediation deadline of August 10, 2022. The EPSS score of 94.42% (99.98th percentile) places it among the most actively exploited vulnerabilities in the wild.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| oracle | weblogic server | 10.3.6.0.0; 12.1.3.0.0; 12.2.1.1.0; 12.2.1.2.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html(Patch, Vendor Advisory)
- http://www.securityfocus.com/bid/101304(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1039608(Broken Link, Third Party Advisory, VDB Entry)
- https://github.com/c0mmand3rOpSec/CVE-2017-10271(Exploit)
- https://www.exploit-db.com/exploits/43458/(Exploit, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/43924/(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-10271(US Government Resource)
Weakness Type
CWE-306: Missing Authentication for Critical Function
CVE-2017-10271 is classified under CWE-306 — Missing Authentication for Critical Function. This weakness occurs when a software component that performs a critical action does not require authentication, allowing unauthenticated users to access functionality that should be restricted.
In the context of Oracle WebLogic Server, the WLS Security component exposes an XML deserialization endpoint that does not properly require authentication before processing incoming requests. Attackers can send specially crafted XML payloads to the server that are deserialized and executed without verifying the identity or authorization of the requester. This missing authentication check on a critical processing function transforms what should be a restricted administrative capability into an unauthenticated attack surface accessible to anyone who can reach the server over the network.
Impact Analysis
CVE-2017-10271 carries a CVSS 3.1 base score of 7.5 (HIGH) with a notable impact profile focused on availability.
Confidentiality (None): The CVSS vector indicates no direct confidentiality impact from the vulnerability itself. However, real-world exploitation chains frequently escalate beyond the initial vulnerability to access sensitive data, as code execution on the WebLogic server provides a foothold for further attacks.
Integrity (None): Similarly, the formal CVSS rating does not attribute integrity impact to this vulnerability in isolation. In practice, attackers who achieve code execution through this flaw regularly modify system files, install persistent backdoors, and deploy cryptominers or other malware.
Availability (High): The primary rated impact is on availability. Exploitation has been widely used to deploy cryptocurrency mining software that consumes server resources, causing significant performance degradation and potential service outages for applications hosted on the affected WebLogic server.
Ransomware association: CISA's KEV catalog confirms a known ransomware association for CVE-2017-10271. This elevates the real-world impact well beyond the formal CVSS scoring, as ransomware attacks can result in complete data encryption and prolonged service outages.
With an EPSS score of 94.42% (99.98th percentile), this is among the most frequently exploited vulnerabilities tracked, reflecting widespread automated exploitation campaigns.
Exploit Maturity
CVE-2017-10271 has an extremely high exploit maturity with widespread automated exploitation and confirmed ransomware use.
Public exploits available: Multiple exploit modules are publicly available on Exploit-DB (IDs 43458 and 43924) and on GitHub (c0mmand3rOpSec/CVE-2017-10271). These exploits demonstrate XML deserialization attacks against the WebLogic WLS Security component.
Ransomware association: CISA's KEV catalog explicitly confirms ransomware association. The vulnerability has been leveraged by ransomware operators for initial access to enterprise servers.
Cryptomining campaigns: CVE-2017-10271 became one of the most widely exploited vulnerabilities for cryptocurrency mining campaigns in 2017-2018. Automated scanning and exploitation tools targeted exposed WebLogic servers globally to deploy mining software.
KEV listing: CISA added this vulnerability to the KEV catalog on February 10, 2022, with a federal remediation deadline of August 10, 2022.
Attack automation: The simplicity of exploitation — requiring only a crafted HTTP request with an XML payload — has led to fully automated exploitation tools that scan the internet for vulnerable WebLogic instances.
EPSS context: The EPSS score of 94.42% (99.98th percentile) is one of the highest observed, confirming near-universal exploitation activity.
Remediation
-
Apply Oracle Critical Patch Update immediately. Install the patches from the Oracle October 2017 Critical Patch Update for WebLogic Server. The fix addresses the deserialization vulnerability in the WLS Security component.
-
Upgrade WebLogic Server to a supported version. If running versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0, or 12.2.1.2.0, plan an upgrade to a current, fully patched release that addresses this and subsequent vulnerabilities.
-
Restrict network access to WebLogic administration ports. Use firewall rules to limit access to the T3 protocol and WebLogic administration console to trusted management networks only. Block public internet access to ports 7001 and 7002.
-
Disable unnecessary protocols and endpoints. If the T3 protocol is not required for your deployment, disable it. Configure WebLogic connection filters to restrict T3 access to specific IP ranges.
-
Scan for indicators of compromise. Check for unauthorized cryptocurrency mining processes, unexpected network connections to mining pools, new user accounts, webshells, or modified system files. Review WebLogic server logs for suspicious XML payloads and unusual request patterns.
-
Implement web application firewall rules. Deploy WAF rules to detect and block XML deserialization attack payloads targeting WebLogic endpoints. This provides a defense layer while patches are being applied across the environment.
Technical Details
CVE-2017-10271 is a remote code execution vulnerability in the WLS Security component of Oracle WebLogic Server. The vulnerability stems from unsafe XML deserialization in an unauthenticated endpoint.
Attack vector and prerequisites: The attack is network-based (AV:N) with low complexity (AC:L), requires no privileges (PR:N) and no user interaction (UI:N). An attacker only needs network access to the WebLogic server's HTTP or T3 protocol port, typically port 7001.
Exploitation mechanism: The vulnerability exploits unsafe deserialization of XMLDecoder-processed input in the WLS Security component. An attacker sends a crafted HTTP POST request containing a malicious XML payload to the WebLogic server. The server deserializes this XML without proper authentication or input validation, allowing the attacker to instantiate arbitrary Java objects and execute system commands.
Typical exploit payload: Attack payloads commonly use the Java ProcessBuilder or Runtime.exec() methods within the XML structure to execute operating system commands. This enables downloading and executing cryptocurrency miners, reverse shells, or ransomware payloads.
Affected versions: Oracle WebLogic Server versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0, and 12.2.1.2.0. The vulnerability is accessible through the default HTTP listener without requiring any form of authentication.
CVSS vector analysis: AV:N/AC:L/PR:N/UI:N/S:U — while the formal vector rates only availability impact as High, real-world exploitation consistently achieves full system compromise.
Frequently Asked Questions
What is CVE-2017-10271?
CVE-2017-10271 is a high-severity vulnerability in Oracle WebLogic Server that allows unauthenticated remote code execution through unsafe XML deserialization in the WLS Security component. Attackers can send specially crafted HTTP requests to execute arbitrary commands on the server. It carries a CVSS score of 7.5 and has confirmed ransomware association.
Which versions of WebLogic Server are affected?
Affected versions include Oracle WebLogic Server 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0, and 12.2.1.2.0. Any deployment exposing the WebLogic HTTP or T3 listener to untrusted networks without the October 2017 Critical Patch Update is vulnerable.
How do I fix CVE-2017-10271?
Apply the Oracle October 2017 Critical Patch Update for WebLogic Server. Restrict network access to WebLogic administration ports, especially the T3 protocol on port 7001. If T3 is not required, disable it entirely. Scan existing servers for signs of cryptocurrency mining software or other indicators of compromise before patching.
How severe is CVE-2017-10271?
CVE-2017-10271 is rated HIGH with a CVSS score of 7.5, but its real-world impact is significantly greater due to confirmed ransomware association and massive cryptocurrency mining campaigns. The EPSS score of 94.42% (99.98th percentile) confirms it as one of the most actively exploited vulnerabilities. Automated tools continuously scan for exposed WebLogic instances.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.